boost-skill-cli 1.0.451__tar.gz → 1.0.452__tar.gz

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.451
+Version: 1.0.452
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.451'
-__version_tuple__ = version_tuple = (1, 0, 451)
+__version__ = version = '1.0.452'
+__version_tuple__ = version_tuple = (1, 0, 452)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/boost_cli/commands/pkg.py

@@ -568,6 +568,7 @@ def cmd_uninstall(argv: list[str]) -> int:
 _PLAN_LABELS = [
     ("missing_store", "missing from store"),
     ("missing_links", "missing agent links"),
+    ("blocked_links", "agent links blocked by a foreign file"),
     ("stale_links", "stale links"),
     ("orphaned_store", "orphaned store dirs"),
     ("missing_materializations", "missing rule/workflow files"),
@@ -651,9 +652,11 @@ def cmd_sync(argv: list[str]) -> int:
                 journal.log("prune", name)
                 pruned.append(name)
     left = [n for n in orphans if n not in pruned]
+    blocked = plan["blocked_links"]
     if args.json:
         print(json.dumps({"actions": actions, "pruned": pruned,
-                          "orphaned_store": left, "out_of_scope_links": oos}))
+                          "orphaned_store": left, "out_of_scope_links": oos,
+                          "blocked_links": blocked}))
         return 0
     for a in actions:
         out.ok(a)
@@ -668,7 +671,17 @@ def cmd_sync(argv: list[str]) -> int:
                  "`boost install <skill> --force` naming every `--agent`"
                  % (_plural(len(oos), "link"),
                     ", ".join("%s → %s" % (n, a) for n, a in oos)))
-    if not actions and not pruned and not left and not oos:
+    # Before this, a blocked link produced no action and no warning, so the
+    # branch below reported "everything in sync" for a repair that had just
+    # been refused — and `boost doctor` went on prescribing this command.
+    if blocked:
+        out.warn("%s could not be created: %s. boost will not delete a file it "
+                 "does not own — move or delete the path, then re-run `boost "
+                 "sync`"
+                 % (_plural(len(blocked), "agent link"),
+                    ", ".join("%s → %s (%s in the way)"
+                              % (n, a, _tilde(Path(p))) for n, a, p in blocked)))
+    if not actions and not pruned and not left and not oos and not blocked:
         out.ok("everything in sync")
     return 0
 

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/boost_cli/commands/quality.py

@@ -427,9 +427,21 @@ def cmd_doctor(argv):
             if adir is None:
                 continue
             link = adir / name
-            if not link.is_symlink() or not link.exists():
+            # Two different failures wore one message. `boost sync` creates a
+            # link where nothing is in the way and replaces a boost-owned one
+            # that dangles — but it will not delete a real file or directory
+            # another installer put there, so prescribing it for that case sent
+            # the reader in a circle: sync answers "everything in sync", doctor
+            # repeats itself. Name the thing in the way instead.
+            if link.is_symlink() and link.exists():
+                continue
+            if not link.is_symlink() and link.exists():
+                bad("skill %s not linked for %s — %s exists and is not a boost "
+                    "link; move or delete it, then run `boost sync`"
+                    % (name, agent, paths.tilde(link)))
+            else:
                 bad("skill %s not linked for %s — run `boost sync`" % (name, agent))
-                skill_issues += 1
+            skill_issues += 1
         # The other direction. `agents` records what is linked and `only_agents`
         # what was asked for, so a link the declaration excludes is pure lock
         # arithmetic here — no second walk of the agent dirs. Doctor has to say

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/boost_cli/core/embed.py

@@ -33,6 +33,7 @@ index.
 from __future__ import annotations
 
 import contextlib
+import http.client
 import json
 import os
 import urllib.error
@@ -253,7 +254,14 @@ def _post(url: str, key: str, payload: dict, timeout: int) -> dict | None:
     try:
         with nethttp.urlopen(req, timeout=timeout) as resp:
             return json.loads(resp.read())
-    except (urllib.error.URLError, OSError, ValueError):
+    # http.client.HTTPException is the gap this list used to have. A connection
+    # cut mid-body raises IncompleteRead, which subclasses HTTPException and
+    # *neither* OSError nor ValueError — so it went straight through and out of
+    # `boost search` as a traceback, for a network hiccup whose right answer is
+    # to fall back to BM25. (RemoteDisconnected was already covered only by
+    # accident: it also subclasses ConnectionResetError.)
+    except (urllib.error.URLError, OSError, ValueError,
+            http.client.HTTPException):
         return None
 
 

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/boost_cli/core/logs.py

@@ -47,6 +47,7 @@ import logging
 import logging.handlers
 import os
 import platform
+import re
 import sys
 import time
 import traceback
@@ -262,10 +263,46 @@ def _boost_version() -> str:
         return "unknown"
 
 
+#: Variable names whose value is a credential by definition. Matched on the
+#: trailing word so ``BOOST_ANTHROPIC_API_KEY``, ``BOOST_GITHUB_TOKEN`` and
+#: ``BOOST_TAP_PASSWORD`` are all caught without enumerating providers.
+_SECRET_NAME = re.compile(
+    r"(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIALS?|AUTH)$", re.IGNORECASE)
+
+#: Value prefixes that are unmistakably a credential whatever the variable is
+#: called. A name denylist alone always trails the next provider someone adds,
+#: and the leak this guards against cost nothing to introduce: boost documents
+#: ``BOOST_ANTHROPIC_API_KEY``, so the variable most likely to be *set* was also
+#: the one most likely to be secret.
+_SECRET_VALUE = re.compile(
+    r"^(?:sk-|pk-|rk-|voy-|pa-|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_"
+    r"|xox[abprs]-|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35})")
+
+REDACTED = "<REDACTED>"
+
+
+def _redact(name: str, value: str) -> str:
+    """The value to print for ``name``, with credentials withheld.
+
+    Redacts rather than drops. A missing line reads as "unset", which sends
+    whoever is reading the crash report down the wrong path — the fact that a
+    key *was* configured is exactly what they need to know.
+    """
+    if _SECRET_NAME.search(name) or _SECRET_VALUE.match(value):
+        return REDACTED
+    # Belt and braces for the shape a credential takes even when it carries no
+    # recognised prefix: one long opaque run with no separators. Excluding
+    # anything path-like keeps ordinary debug values (dirs, URLs) readable.
+    if (len(value) >= 40 and not set(value) & set(" \t/\\")
+            and re.fullmatch(r"[A-Za-z0-9_.+=-]+", value)):
+        return REDACTED
+    return value
+
+
 def _env_snapshot() -> list[str]:
     keys = sorted(k for k in os.environ
                   if k.startswith("BOOST_") or k in ("NO_COLOR", "CLICOLOR_FORCE"))
-    return ["%s=%s" % (k, os.environ[k]) for k in keys]
+    return ["%s=%s" % (k, _redact(k, os.environ[k])) for k in keys]
 
 
 def write_crash_report(exc: BaseException, argv: list[str]) -> Path | None:

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/boost_cli/core/store.py

@@ -251,9 +251,29 @@ def _copy_skill(src: Path, dest: Path) -> None:
     fast renames, and a failed swap rolls back to the original.
     """
     dest = Path(dest)
-    dest.parent.mkdir(parents=True, exist_ok=True)
-    staged = Path(tempfile.mkdtemp(dir=str(dest.parent),
-                                   prefix="." + dest.name + ".tmp"))
+    # Staging needs to *write* next to dest, and a store that cannot be written
+    # is an ordinary, fixable condition — a sandboxed shell, a synced folder, a
+    # store owned by another user. It used to escape as a raw PermissionError
+    # from tempfile.mkdtemp, so boost answered `boost install <skill>` with a
+    # stack trace ending in a temp path nobody recognises, and filed a crash
+    # report for it. Name the directory instead: that is the whole diagnosis.
+    try:
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        staged = Path(tempfile.mkdtemp(dir=str(dest.parent),
+                                       prefix="." + dest.name + ".tmp"))
+    except PermissionError as exc:
+        raise BoostError(
+            "cannot write to the skill store at %s" % dest.parent,
+            hint="check that you own the directory and it is writable "
+                 "(`ls -ld %s`); a sandboxed shell is the usual cause"
+                 % dest.parent) from exc
+    except OSError as exc:
+        # Not a permissions problem — disk full, read-only mount, name too
+        # long. Say which, rather than describing every one of them as denied.
+        raise BoostError(
+            "cannot stage a copy in %s: %s"
+            % (dest.parent, exc.strerror or exc),
+            hint="free space or fix the mount, then re-run") from exc
     backup = None
     try:
         shutil.copytree(
@@ -1257,15 +1277,27 @@ def sync_plan() -> dict[str, list]:
 
     Returns {missing_store, missing_links, stale_links, orphaned_store}
       missing_store:  lock entries whose store dir is gone
-      missing_links:  (skill, agent) pairs that should be linked but aren't
+      missing_links:  (skill, agent) pairs that should be linked but aren't,
+                      and that sync *can* create
+      blocked_links:  (skill, agent, path) where something that is not a boost
+                      symlink occupies the link path — sync will not clobber it
       stale_links:    paths in agent dirs that are broken/unmanaged symlinks
       orphaned_store: store dirs not present in the lock file
       out_of_scope_links: (skill, agent) pairs linked outside a declared
                       ``--agent`` narrowing — reported, never auto-removed
+
+    ``blocked_links`` exists because lumping it into ``missing_links`` made
+    ``boost sync`` promise a repair it could never perform. ``link_agents``
+    refuses to delete a real file or directory it does not own (right), records
+    it in ``.conflicts`` — and ``sync_apply`` dropped that on the floor, so the
+    command printed "everything in sync" while ``boost doctor`` went on
+    reporting the same skill unlinked and prescribing ``boost sync``. Seen for
+    real where another installer had written ``~/.claude/skills/hyperframes``
+    as a directory: a closed loop with no exit.
     """
     lock = lockfile.installed()
     plan: dict[str, list] = {"missing_store": [], "missing_links": [],
-            "stale_links": [], "orphaned_store": [],
+            "blocked_links": [], "stale_links": [], "orphaned_store": [],
             "missing_materializations": [], "out_of_scope_links": []}
     for name, entry in lock.items():
         sdir = skill_store_dir(name)
@@ -1298,7 +1330,14 @@ def sync_plan() -> dict[str, list]:
         in_scope = scoped_agents(entry, linking)
         for agent, adir in in_scope.items():
             link = adir / name
-            if not link.is_symlink() or not link.exists():
+            # A symlink is boost's to replace even when it dangles; anything
+            # else that exists is someone else's file and stays put.
+            if link.is_symlink():
+                if not link.exists():
+                    plan["missing_links"].append((name, agent))
+            elif link.exists():
+                plan["blocked_links"].append((name, agent, str(link)))
+            else:
                 plan["missing_links"].append((name, agent))
         # The other direction, which nothing checked: a link that exists in an
         # agent the declaration excludes. The loop above is narrowed to the

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.451
+Version: 1.0.452
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/boost_skill_cli.egg-info/SOURCES.txt

@@ -219,6 +219,7 @@ docs/roadmap/items/coverage-dashboard-codecov-free-for-oss.md
 docs/roadmap/items/coverage-guided-fuzzing-atheris-oss-fuzz.md
 docs/roadmap/items/crash-listing-branch-untested.md
 docs/roadmap/items/crash-recorder-error-paths-core-logs-py.md
+docs/roadmap/items/crash-reports-leak-api-keys.md
 docs/roadmap/items/demo-cannot-open-its-own-pr.md
 docs/roadmap/items/demo-gif-workflow-has-never-succeeded.md
 docs/roadmap/items/demo-workflow-cancels-other-prs.md
@@ -401,9 +402,11 @@ docs/roadmap/items/surface-every-docs-page-from-the-guide.md
 docs/roadmap/items/sync-could-not-repair-a-gutted-skill.md
 docs/roadmap/items/sync-deletes-unowned-broken-symlinks.md
 docs/roadmap/items/sync-relinks-into-every-agent-ignoring-scope.md
+docs/roadmap/items/sync-reported-success-for-a-link-it-refused.md
 docs/roadmap/items/tap-signing-and-provenance-sigstore-minisign.md
 docs/roadmap/items/theme-asset-linting-stylelint-eslint.md
 docs/roadmap/items/tool-call-eval-tier.md
+docs/roadmap/items/two-crashes-that-should-have-been-messages.md
 docs/roadmap/items/typo-detection-codespell.md
 docs/roadmap/items/typosquat-and-name-confusion-detection.md
 docs/roadmap/items/unify-tilde-two-copies-have-a-boundary-bug.md
@@ -584,6 +587,7 @@ tests/unit/test_community_health_files.py
 tests/unit/test_complete.py
 tests/unit/test_config.py
 tests/unit/test_content_dedupe.py
+tests/unit/test_crash_redaction.py
 tests/unit/test_dedup_trust.py
 tests/unit/test_demo_index.py
 tests/unit/test_dense.py
@@ -599,6 +603,7 @@ tests/unit/test_docsite_chrome.py
 tests/unit/test_ed25519.py
 tests/unit/test_embed.py
 tests/unit/test_embed_local.py
+tests/unit/test_embed_truncated_response.py
 tests/unit/test_entry_key.py
 tests/unit/test_errors_and_cli_table.py
 tests/unit/test_eval_baseline.py
@@ -619,6 +624,7 @@ tests/unit/test_gitutil_lfs.py
 tests/unit/test_imperative.py
 tests/unit/test_import_budget.py
 tests/unit/test_injectscan.py
+tests/unit/test_install_permission_error.py
 tests/unit/test_installscan.py
 tests/unit/test_integrity.py
 tests/unit/test_journal.py
@@ -678,6 +684,7 @@ tests/unit/test_spin.py
 tests/unit/test_stackprobe.py
 tests/unit/test_staleness.py
 tests/unit/test_store.py
+tests/unit/test_sync_blocked_links.py
 tests/unit/test_sync_repairs_gutted_skill.py
 tests/unit/test_token_parity.py
 tests/unit/test_toolchain_lock.py

boost_skill_cli-1.0.452/docs/roadmap/items/crash-reports-leak-api-keys.md

@@ -0,0 +1,33 @@
+---
+id: crash-reports-leak-api-keys
+board: code
+section: trust
+status: shipped
+category: Bug
+complexity: S
+impact: High
+wow: 5
+note:
+order: 3
+owner: fix/audit-findings
+pr:
+title: Crash reports carried API keys in cleartext
+---
+A crash report is the one file boost actively invites a user to paste into a bug report — its
+docstring says so: "a user can attach one file to a bug report instead of reproducing by hand."
+<code>_env_snapshot()</code> built that file by printing every <code>BOOST_*</code> variable
+verbatim. Since boost documents <code>BOOST_ANTHROPIC_API_KEY</code> as the way to supply a key,
+the variable most likely to be <em>set</em> was also the one most likely to be secret.
+
+Found on a real machine, not in review: three reports under <code>~/.boost/logs/</code>, each
+carrying a live <code>sk-ant-api03-…</code> key, written by two ordinary
+<code>boost install</code> failures and one <code>boost search</code>. Nothing had to go wrong
+beyond the crash itself — the leak was the reporting path working as designed.
+
+Values are now withheld two ways, because either alone rots. A name ending in
+<code>KEY</code>/<code>TOKEN</code>/<code>SECRET</code>/<code>PASSWORD</code>/<code>AUTH</code> is
+redacted, which covers every provider without enumerating them; and a value carrying a known
+credential prefix (<code>sk-</code>, <code>ghp_</code>, <code>xox…</code>, <code>AKIA…</code>) is
+redacted whatever it is called, because a name denylist always trails the next provider someone
+adds. Redacted, never dropped: a missing line reads as "unset", and the fact that a key
+<em>was</em> configured is exactly what the reader needs.

boost_skill_cli-1.0.452/docs/roadmap/items/sync-reported-success-for-a-link-it-refused.md

@@ -0,0 +1,32 @@
+---
+id: sync-reported-success-for-a-link-it-refused
+board: code
+section: compat
+status: shipped
+category: Bug
+complexity: S
+impact: High
+wow: 4
+note:
+order: 12
+owner: fix/audit-findings
+pr:
+title: <code>sync</code> reported success for a link it had just refused
+---
+Observed on a real machine as a closed loop with no exit: <code>boost sync</code> answers
+"✓ everything in sync" &middot; <code>boost doctor</code> answers "! skill hyperframes not linked
+for claude-code — run <code>boost sync</code>" &middot; repeat forever.
+
+Another installer had written <code>~/.claude/skills/hyperframes</code> as a real directory.
+<code>link_agents</code> correctly refuses to delete a path boost does not own and records it in
+<code>.conflicts</code> — but <code>sync_apply</code> dropped that value on the floor, appended no
+action, and the command layer read "no actions" as "nothing to do". Doctor, meanwhile, tested only
+<code>is_symlink()</code> and prescribed the command that had just declined to help.
+
+<code>sync_plan</code> now separates the two cases it had been conflating: a
+<code>missing_link</code> is one sync can create (nothing in the way, or a dangling symlink boost
+owns and may replace), and a <code>blocked_link</code> is a path occupied by a file boost will not
+touch. <code>sync</code> warns and names the path; <code>doctor</code> says why sync did nothing
+and gives the step that unblocks it. store.py's own comment already named this anti-pattern — "sync
+would answer 'everything in sync', change nothing, and send the reader back to the same error" —
+one function above the code that was doing it.

boost_skill_cli-1.0.452/docs/roadmap/items/two-crashes-that-should-have-been-messages.md

@@ -0,0 +1,34 @@
+---
+id: two-crashes-that-should-have-been-messages
+board: code
+section: compat
+status: shipped
+category: Bug
+complexity: S
+impact: Medium
+wow: 3
+note:
+order: 13
+owner: fix/audit-findings
+pr:
+title: Two crashes that should have been messages
+---
+Both were found by reading the crash reports on a real machine rather than by review, and both are
+the same shape: an expected, fixable condition escaping as a traceback.
+
+<strong>An unwritable store.</strong> <code>store._copy_skill</code> stages its copy with
+<code>tempfile.mkdtemp</code> next to the destination. Where <code>~/.agents/skills</code> could not
+be written — a sandboxed shell is the usual cause — the raw <code>PermissionError</code> escaped, so
+<code>boost install &lt;skill&gt;</code> answered with a stack trace ending in a temp path nobody
+recognises, and filed a crash report for a permissions problem. It now names the directory, which
+is the whole diagnosis. A non-permissions <code>OSError</code> (disk full, read-only mount) is
+reported as itself rather than described as denied.
+
+<strong>A truncated embedding response.</strong> <code>embed._post</code> guarded with
+<code>except (URLError, OSError, ValueError)</code>. <code>http.client.IncompleteRead</code> — what
+a connection cut mid-body raises — subclasses <code>HTTPException</code> and <em>none</em> of those
+three, so it went straight through <code>resp.read()</code> and out of <code>boost search</code>.
+Seen as <code>IncompleteRead(6629 bytes read, 6200 more expected)</code> on
+<code>boost search mempalace</code>. The right answer to a network hiccup is to return None and let
+retrieval fall back to BM25, which is what it now does. <code>RemoteDisconnected</code> had been
+covered only by accident — it also subclasses <code>ConnectionResetError</code>.

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/docs/roadmap.html

@@ -133,7 +133,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>7</b><span>Planned</span></div>
-      <div class="stat"><b>246</b><span>Loop finds</span></div>
+      <div class="stat"><b>249</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -9218,6 +9218,64 @@ reaches the network as a side effect of checking what a command prints.</p></det
         </div>
       </article>
 
+      <article class="cap rcard" id="sync-reported-success-for-a-link-it-refused">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug</span></div>
+        <h3><code>sync</code> reported success for a link it had just refused</h3>
+        <details class="cardbody"><summary>Write-up</summary>
+        <p>Observed on a real machine as a closed loop with no exit: <code>boost sync</code> answers
+"✓ everything in sync" &middot; <code>boost doctor</code> answers "! skill hyperframes not linked
+for claude-code — run <code>boost sync</code>" &middot; repeat forever.
+
+Another installer had written <code>~/.claude/skills/hyperframes</code> as a real directory.
+<code>link_agents</code> correctly refuses to delete a path boost does not own and records it in
+<code>.conflicts</code> — but <code>sync_apply</code> dropped that value on the floor, appended no
+action, and the command layer read "no actions" as "nothing to do". Doctor, meanwhile, tested only
+<code>is_symlink()</code> and prescribed the command that had just declined to help.
+
+<code>sync_plan</code> now separates the two cases it had been conflating: a
+<code>missing_link</code> is one sync can create (nothing in the way, or a dangling symlink boost
+owns and may replace), and a <code>blocked_link</code> is a path occupied by a file boost will not
+touch. <code>sync</code> warns and names the path; <code>doctor</code> says why sync did nothing
+and gives the step that unblocks it. store.py's own comment already named this anti-pattern — "sync
+would answer 'everything in sync', change nothing, and send the reader back to the same error" —
+one function above the code that was doing it.</p></details>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+        </div>
+      </article>
+
+      <article class="cap rcard" id="two-crashes-that-should-have-been-messages">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug</span></div>
+        <h3>Two crashes that should have been messages</h3>
+        <details class="cardbody"><summary>Write-up</summary>
+        <p>Both were found by reading the crash reports on a real machine rather than by review, and both are
+the same shape: an expected, fixable condition escaping as a traceback.
+
+<strong>An unwritable store.</strong> <code>store._copy_skill</code> stages its copy with
+<code>tempfile.mkdtemp</code> next to the destination. Where <code>~/.agents/skills</code> could not
+be written — a sandboxed shell is the usual cause — the raw <code>PermissionError</code> escaped, so
+<code>boost install &lt;skill&gt;</code> answered with a stack trace ending in a temp path nobody
+recognises, and filed a crash report for a permissions problem. It now names the directory, which
+is the whole diagnosis. A non-permissions <code>OSError</code> (disk full, read-only mount) is
+reported as itself rather than described as denied.
+
+<strong>A truncated embedding response.</strong> <code>embed._post</code> guarded with
+<code>except (URLError, OSError, ValueError)</code>. <code>http.client.IncompleteRead</code> — what
+a connection cut mid-body raises — subclasses <code>HTTPException</code> and <em>none</em> of those
+three, so it went straight through <code>resp.read()</code> and out of <code>boost search</code>.
+Seen as <code>IncompleteRead(6629 bytes read, 6200 more expected)</code> on
+<code>boost search mempalace</code>. The right answer to a network hiccup is to return None and let
+retrieval fall back to BM25, which is what it now does. <code>RemoteDisconnected</code> had been
+covered only by accident — it also subclasses <code>ConnectionResetError</code>.</p></details>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Medium</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+        </div>
+      </article>
+
       <article class="cap rcard" id="mcp-register-names-server-before-env">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug · MCP</span></div>
         <h3>Order the server name before -e flags in `boost mcp register`</h3>
@@ -9656,6 +9714,35 @@ the command layer never was.</p></details>
         </div>
       </article>
 
+      <article class="cap rcard" id="crash-reports-leak-api-keys">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug</span></div>
+        <h3>Crash reports carried API keys in cleartext</h3>
+        <details class="cardbody"><summary>Write-up</summary>
+        <p>A crash report is the one file boost actively invites a user to paste into a bug report — its
+docstring says so: "a user can attach one file to a bug report instead of reproducing by hand."
+<code>_env_snapshot()</code> built that file by printing every <code>BOOST_*</code> variable
+verbatim. Since boost documents <code>BOOST_ANTHROPIC_API_KEY</code> as the way to supply a key,
+the variable most likely to be <em>set</em> was also the one most likely to be secret.
+
+Found on a real machine, not in review: three reports under <code>~/.boost/logs/</code>, each
+carrying a live <code>sk-ant-api03-…</code> key, written by two ordinary
+<code>boost install</code> failures and one <code>boost search</code>. Nothing had to go wrong
+beyond the crash itself — the leak was the reporting path working as designed.
+
+Values are now withheld two ways, because either alone rots. A name ending in
+<code>KEY</code>/<code>TOKEN</code>/<code>SECRET</code>/<code>PASSWORD</code>/<code>AUTH</code> is
+redacted, which covers every provider without enumerating them; and a value carrying a known
+credential prefix (<code>sk-</code>, <code>ghp_</code>, <code>xox…</code>, <code>AKIA…</code>) is
+redacted whatever it is called, because a name denylist always trails the next provider someone
+adds. Redacted, never dropped: a missing line reads as "unset", and the fact that a key
+<em>was</em> configured is exactly what the reader needs.</p></details>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★★</b></span>
+        </div>
+      </article>
+
       <article class="cap rcard" id="tap-signing-and-provenance-sigstore-minisign">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Provenance</span></div>
         <h3>Tap signing &amp; provenance — Sigstore / minisign</h3>

{boost_skill_cli-1.0.451 → boost_skill_cli-1.0.452}/tests/functional/test_cli_pkg.py

@@ -1184,12 +1184,13 @@ class TestSyncJson:
         assert "everything in sync" in r.out
         plan = json.loads(boost("sync", "--diff", "--json").out)
         assert plan == {"missing_store": [], "missing_links": [],
-                        "stale_links": [], "orphaned_store": [],
+                        "blocked_links": [], "stale_links": [],
+                        "orphaned_store": [],
                         "missing_materializations": [], "out_of_scope_links": [],
                         "project": {"missing": [], "orphaned": []}}
         data = json.loads(boost("sync", "--json").out)
         assert data == {"actions": [], "pruned": [], "orphaned_store": [],
-                        "out_of_scope_links": []}
+                        "out_of_scope_links": [], "blocked_links": []}
 
     def test_a_narrowing_reinstall_is_reported_and_pruned_only_on_request(
             self, boost, installed):

boost_skill_cli-1.0.452/tests/unit/test_crash_redaction.py

@@ -0,0 +1,58 @@
+"""A crash report is the one file users are invited to paste into a bug report.
+
+`_env_snapshot` captured every ``BOOST_*`` variable verbatim, and boost's own
+documented way to supply a key is ``BOOST_ANTHROPIC_API_KEY`` — so the variable
+most likely to be set was also the one most likely to be secret. Three reports
+on a real machine carried a live ``sk-ant-api03-...`` key in cleartext.
+"""
+from __future__ import annotations
+
+import pytest
+
+from boost_cli.core import logs
+
+
+class TestEnvSnapshotRedaction:
+    SECRET = "sk-ant-api03-" + "x" * 80
+
+    @pytest.mark.parametrize("var", [
+        "BOOST_ANTHROPIC_API_KEY",
+        "BOOST_OPENAI_API_KEY",
+        "BOOST_VOYAGE_API_KEY",
+        "BOOST_GITHUB_TOKEN",
+        "BOOST_REGISTRY_SECRET",
+        "BOOST_TAP_PASSWORD",
+    ])
+    def test_secret_value_never_appears(self, var, monkeypatch):
+        monkeypatch.setenv(var, self.SECRET)
+        body = "\n".join(logs._env_snapshot())
+        assert self.SECRET not in body
+        assert var in body, "the variable is still worth reporting — only its value is not"
+
+    def test_redaction_is_marked_not_silently_dropped(self, monkeypatch):
+        monkeypatch.setenv("BOOST_ANTHROPIC_API_KEY", self.SECRET)
+        line = next(x for x in logs._env_snapshot() if x.startswith("BOOST_ANTHROPIC_API_KEY"))
+        # A dropped line reads as "unset", which sends a bug reporter down the
+        # wrong path. Say the value was withheld.
+        assert "REDACTED" in line
+
+    def test_non_secret_values_survive(self, monkeypatch):
+        monkeypatch.setenv("BOOST_ASSUME_YES", "1")
+        monkeypatch.setenv("BOOST_NO_AI", "1")
+        body = "\n".join(logs._env_snapshot())
+        assert "BOOST_ASSUME_YES=1" in body
+        assert "BOOST_NO_AI=1" in body
+
+    def test_crash_report_on_disk_carries_no_secret(self, monkeypatch, sandbox):
+        monkeypatch.setenv("BOOST_ANTHROPIC_API_KEY", self.SECRET)
+        report = logs.write_crash_report(RuntimeError("boom"), ["install", "x"])
+        assert report is not None
+        assert self.SECRET not in report.read_text(encoding="utf-8")
+
+    def test_a_secret_by_value_shape_is_caught_whatever_its_name(self, monkeypatch):
+        # Name-matching alone is a denylist and will always trail the next
+        # variable someone adds. A value that is unmistakably a key is redacted
+        # on its shape too.
+        monkeypatch.setenv("BOOST_SOMETHING_HARMLESS_SOUNDING", self.SECRET)
+        body = "\n".join(logs._env_snapshot())
+        assert self.SECRET not in body